[PATCH 1/2] server: Don't release SndChannel twice from worker reference

[Andrew Eikum <aeikum@xxxxxxxxxxxxxxx>]

When we release the SndChannel reference during
snd_disconnect_channel(), we need to set the pointer to NULL so it
doesn't get released again on client reconnect during
snd_set_playback_peer(). This can happen when a reference is held from
_playback_get_buffer().
---
 server/snd_worker.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/snd_worker.c b/server/snd_worker.c
index 995823c..13f8c4d 100644
--- a/server/snd_worker.c
+++ b/server/snd_worker.c
@@ -195,7 +195,6 @@ static SndChannel *snd_channel_get(SndChannel *channel)
 static SndChannel *snd_channel_put(SndChannel *channel)
 {
     if (!--channel->refs) {
-        channel->worker->connection = NULL;
         free(channel);
         spice_printerr("sound channel freed");
         return NULL;
@@ -223,6 +222,7 @@ static void snd_disconnect_channel(SndChannel *channel)
         spice_marshaller_destroy(channel->send_data.marshaller);
     }
     snd_channel_put(channel);
+    channel->worker->connection = NULL;
 }
 
 static void snd_playback_free_frame(PlaybackChannel *playback_channel, AudioFrame *frame)

_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/spice-devel